# Manage Trust Center Access

Control who can access restricted Trust Center content using requests, manual approvals, and domain-based rules.

This system is designed to give you **full visibility and control** over external access.

<div style="
  background: rgba(128,128,128,0.08);
  border: 2px solid rgba(128,128,128,0.25);
  border-radius: 10px;
  padding: 20px 20px 0px 20px;
">
  <div style="font-weight:700; margin-bottom:20px;">Who can use this feature?</div>

  <table style="border-collapse:collapse;">
    <tr>
  <td style="vertical-align:top; padding:0 8px 10px 0;">
    <Icon icon="material-filled-person" color="#d760f9"/>
  </td>
  <td style="vertical-align:top; padding:0 0 10px 0;">
    All <span style="color:#d760f9; font-weight:600;">Account Owners</span> and <span style="color:#d760f9; font-weight:600;">Security Admins</span>
  </td>
</tr>
    <tr>
  <td style="vertical-align:top; padding:0 8px 0 0;">
    <Icon icon="material-filled-flag" color="#d760f9"/>
  </td>
  <td style="vertical-align:top; padding:0;">
    Available on all plans
  </td>
</tr>
  </table>
</div>

# How Access Management Works

Access to restricted content is controlled through four key components:

| Component | Purpose |
|----------|--------|
| **Requests** | Incoming access requests from external users |
| **Contacts** | Users who currently have or had access |
| **Domains** | Automatic approval and domain-level control |

## Access Lifecycle

1. User attempts to access restricted content  
2. A request is created in **Requests**  
3. You approve or deny the request  
4. Approved/Denied users added to **Contacts**  
5. Access can be revoked or managed later  
6. All actions are recorded in **Events**

:::info
Access requests are only generated for content marked as **Approved Visitors**.
:::

---

# Accessing the Access Controls

<Steps>
<Step title="Open Trust Center">
Navigate to **Trust Center** from the left-hand menu.
</Step>

<Step title="Locate Detailed Information">
Scroll to the **Detailed Information** section below the analytics dashboard.
</Step>

<Step title="Select a Management Tab">
Choose between:
- **Requests** → Review incoming requests  
- **Contacts** → Manage approved users  
- **Domains** → Configure automatic approvals  
- **Events** → View audit logs  
</Step>
</Steps>

---

# Requests (Review & Approve Access)

The **Requests** tab is where all incoming access requests are reviewed. 

:::tip[]
Requests marked **Needs Attention** require action.
:::

## Approve a Request

<Steps>
<Step title="Open Requests Tab">
Navigate to the **Requests** tab.
</Step>

<Step title="Identify Pending Requests">
Look for requests labeled **Needs Attention**.
</Step>

<Step title="Review Request Details">
Confirm:
- The requester’s email/domain  
- Their stated reason for access  
- Whether they are a legitimate stakeholder
</Step>

<Step title="Approve Request">
Click the **✔ (Approve)** icon in the Actions column.
</Step>

<Step title="Confirm Approval">
Review the confirmation dialog and click **Approve**. This grants the user full access to Approved Visitor content.
</Step>
</Steps>

## Deny a Request

<Steps>
<Step title="Select Request">
Locate the request in the **Requests** tab.
</Step>

<Step title="Deny Access">
Click the **✖ (Deny)** icon.
</Step>

<Step title="Optional Reason">
Enter a denial reason to provide context to the requester.
</Step>

<Step title="Confirm Denial">
Choose:
- **Deny** → Reject this request only  
- **Deny & Block Future Requests** → Prevent future submissions from this user
</Step>
</Steps>

---

# Contacts (Manage Approved Users)
The **Contacts** tab shows all users who have been granted or denied access.

## Grant Access Manually

<Steps>
<Step title="Open Contacts Tab">
Navigate to the **Contacts** tab.
</Step>

<Step title="Add New Contact">
Click **Add Contact** in the top-right corner.
</Step>

<Step title="Enter Contact Details">
Provide:
- First Name  
- Last Name  
- Email Address  

Ensure the email domain is valid.
</Step>

<Step title="Save Contact">
Click **Add Contact** to grant access. The user will immediately have access to restricted content.
</Step>
</Steps>

## Allow Access for Existing Contact

<Steps>
<Step title="Locate Contact">
Find a user with **Access Rejected**, **Access Revoked**, or **Access Blocked**
</Step>

<Step title="Grant Access">
Click **Allow Access** in the Actions column.
</Step>

<Step title="Confirm Action">
The user’s status updates to **Access Granted** and access is restored.
</Step>
</Steps>

## Revoke Access

<Steps>
<Step title="Locate Approved User">
Find a user with **Access Granted**.
</Step>

<Step title="Revoke Access">
Click **Revoke Access** in the Actions column.
</Step>

<Step title="Confirm Revocation">
Choose:
- **Revoke** → Remove access  
- **Revoke & Block Future Access** → Prevent future requests
</Step>

<Step title="Access Removed">
The user immediately loses access to restricted content.
</Step>
</Steps>

---

# Domains (Automate Access Control)
The **Domains** tab allows you to manage access at the domain level. This is useful for automatically approving trusted organizations.

## Enable Auto-Approval

<Steps>
<Step title="Open Domains Tab">
Navigate to the **Domains** tab.
</Step>

<Step title="Locate Domain">
Find the domain you want to configure.
</Step>

<Step title="Enable Auto-Approve">
Toggle **Auto-Approve Requests**. All users from this domain will be automatically granted access.
</Step>

<Step title="Verify Status">
Ensure the domain is marked **Active**.
</Step>
</Steps>

## Revoke Domain Access

<Steps>
<Step title="Select Domain">
Locate the domain in the list.
</Step>

<Step title="Revoke Access">
Click **Revoke Access**.
</Step>

<Step title="Confirm Action">
Choose:
- **Revoke** → Remove access for all users in the domain  
- **Revoke & Block Future Access** → Prevent future requests from this domain
</Step>

<Step title="Access Removed">
All associated users immediately lose access.
</Step>
</Steps>

---

# Best Practices

- Use **Domains** for trusted partners to reduce manual approvals  
- Use **Requests** for one-off or unknown users  
- Regularly review **Contacts** to remove inactive users  
- Monitor **Events** for auditing and compliance  

---

# Troubleshooting

<AccordionGroup>

<Accordion title="User Cannot Access Content" defaultOpen>
Check:
- Request has been approved  
- User appears in Contacts  
- Content visibility is set to Approved Visitors  
</Accordion>

<Accordion title="User Still Has Access After Revocation">
Ensure:
- Revocation was confirmed  
- No domain auto-approval is re-granting access  
</Accordion>

<Accordion title="Too Many Requests to Manage">
Solution:
- Enable domain auto-approval for trusted organizations  
</Accordion>

</AccordionGroup>